|Publication number||US7184942 B2|
|Application number||US 10/444,453|
|Publication date||Feb 27, 2007|
|Filing date||May 22, 2003|
|Priority date||May 22, 2003|
|Also published as||US20040249916|
|Publication number||10444453, 444453, US 7184942 B2, US 7184942B2, US-B2-7184942, US7184942 B2, US7184942B2|
|Inventors||David Andrew Graves, Brian John O'Keefe|
|Original Assignee||Hewlett-Packard Development Company, L.P.|
|Export Citation||BiBTeX, EndNote, RefMan|
|Patent Citations (14), Referenced by (7), Classifications (14), Legal Events (6)|
|External Links: USPTO, USPTO Assignment, Espacenet|
Embodiments of the present invention relate to virtual networks (e.g., virtual local area networks). More specifically, embodiments of the present invention relate to virtual networks used as utility data centers and server farms, for example.
Devices such as computer systems, routers, switches, load balancers, firewalls, and the like, are commonly linked to each other in networks. These networks are configured in different ways depending on implementation-specific details such as the hardware used and the physical location of the equipment, and also depending on the particular objectives of the network. One common type of network configuration includes a number of “virtual” networks, commonly known as virtual local area networks (VLANs). A VLAN is, in essence, a logical segmentation of a physical local area network (LAN).
An advantage of VLANs is that the devices associated with a particular virtual network do not need to all be in the same physical location, yet all will appear to be on the same LAN. Prior Art
In the simplified example of Prior Art
For reasons such as security or privacy, communication between VLANs may not be permitted. In LAN 10, access to a particular VLAN is controlled by the switches 11–16. For example, switch 16 can be configured to forward a message from computer system 30 (VLAN 1) to computer system 37 (VLAN 1) but to not forward a message from computer system 30 (VLAN 1) to computer system 36 (VLAN 2). In a similar manner, communication from a remote device can be controlled so that the remote device can only communicate with certain devices in LAN 10. Therefore, even though VLANs can share resources such as switches, VLANs can be prevented from sharing traffic and information.
Another advantage of VLANs is that the management and cabling of groups of devices are simplified, particularly when the allocation of resources within the LAN is changed. For instance, in the simplified example of Prior Art
In actual practice, a typical LAN will include large numbers of computer systems and switches (as well as other devices), with frequent changes to the allocation of these resources among the various VLANs. Each change may result in the reconfiguring of multiple switches. Typically, when a change is made, a human operator inputs/issues commands to reconfigure the affected switches. When done manually, this can be a tedious and time-consuming process that is also prone to human error.
Automated processes are becoming available to assist in the configuring of VLANs. However, these processes still have their shortcomings, particularly with regard to the verification of proper configuration of switches and therefore of VLANs. Some prior art techniques rely on manual procedures to verify correctness of the switch configurations. Typically, these procedures require logging into each switch, issuing commands to view their existing configurations, comparing those configurations to documentation of the desired (design) state, and then issuing commands to correct any discrepancies. Once the switches are reconfigured to correct any discrepancies, it may even be necessary to repeat the verification process. In general, manual verification is slow, costly and prone to human error.
Other prior art techniques essentially rely on the automated configuration process itself to ensure correct configuration of the switches and VLANs. For example, using information from a database, an automated procedure may exist for sending configuration commands to a switch. Such procedures may eliminate one source of human error, but they still have their shortcomings. Significantly, such procedures do not provide the capability to check that the switch configuration matches that of the database. Commands may go awry, may be misdirected to an incorrect switch, or may not be implemented as intended. Switches may malfunction during operation, perhaps losing some of their programming. A switch may be hacked with malicious intent, perhaps causing it to direct traffic to an unauthorized destination or to not forward traffic at all to certain destinations.
For these and other reasons, a method and/or system that can verify that switches and hence VLANs are properly configured would be of value. Embodiments of the present invention provide this and other advantages.
Embodiments of the present invention pertain to methods and systems for verifying that a virtual network is properly configured. In one embodiment, configuration information from devices in the virtual network is received. The configuration information is compared against reference information. The reference information represents the design of the virtual network. Discrepancies between the configuration of the devices and the design of the virtual network are identified.
The accompanying drawings, which are incorporated in and form a part of this specification, illustrate embodiments of the invention and, together with the description, serve to explain the principles of the invention:
The drawings referred to in this description should not be understood as being drawn to scale except if specifically noted.
Reference will now be made in detail to various embodiments of the invention, examples of which are illustrated in the accompanying drawings. While the invention will be described in conjunction with these embodiments, it will be understood that they are not intended to limit the invention to these embodiments. On the contrary, the invention is intended to cover alternatives, modifications and equivalents, which may be included within the spirit and scope of the invention as defined by the appended claims. Furthermore, in the following description of the present invention, numerous specific details are set forth in order to provide a thorough understanding of the present invention. In other instances, well-known methods, procedures, components, and circuits have not been described in detail as not to unnecessarily obscure aspects of the present invention.
Aspects of the present invention may be practiced on a computer system that includes, in general, a processor for processing information and instructions, random access (volatile) memory (RAM) for storing information and instructions, read-only (non-volatile) memory (ROM) for storing static information and instructions, a data storage device such as a magnetic or optical disk and disk drive for storing information and instructions, an optional user output device such as a display device (e.g., a monitor) for displaying information to the computer user, an optional user input device including alphanumeric and function keys (e.g., a keyboard) for communicating information and command selections to the processor, and an optional user input device such as a cursor control device (e.g., a mouse) for communicating user input information and command selections to the processor.
In general, LAN 110 utilizes a programmable infrastructure that enables the virtual connection of selected computing resources as well as the isolation of selected computing resources, thereby ensuring the security and segregation of computing resources at the lowest infrastructure level. The pool of computing resources in the LAN 110 includes pre-wired, pre-integrated, and pre-tested physical resources. The computing resources in the LAN 110 can be dynamically and logically reconfigured into various virtual local area networks (VLANs). A number of such VLANs can be created and managed by the utility controller software.
In the present embodiment, LAN 110 includes a number of switches 111 through 116, and a number of computers 130–138 that are couplable to the switches 111–116. Typically, the computers 130–138 are physically located in computer racks 120, 121 and 122, although this may not always be the case. In this embodiment, the switches and computer systems are interconnected using cables or the like. However, wireless connections between devices in LAN 110 are also contemplated.
In the present embodiment, the switches 111–116 can be programmed or configured such that LAN 110 is logically separated into a number of VLANs. The programming or configuring of these switches can be changed, thereby changing the resources allocated to the various VLANs. For example, by changing the configuration of switch 114, computer system 130 can be “moved” from one VLAN to another. The allocation and reallocation of resources between VLANs can be achieved without changing the physical wiring between devices.
In addition to computer systems and switches, LAN 110 can include other types of devices such as, but not limited to, routers, load balancers, firewalls, and hubs. These other types of devices may also be programmable or configurable. As will be seen, the features of the present invention can be used with these types of devices as well as with switches. That is, although described primarily in the context of switches, the features of the present invention are not so limited.
The term “configurable device” is used herein to refer to devices that can be programmed or configured. The term “configuration information” is used herein to refer to information that describes the configuration of a configurable device. If, for example, a configurable device is reallocated from one VLAN to another, its configuration information is updated to effect the change. In the present embodiment, the configuration information for a configurable device resides on the device, from which it can be read or retrieved. The actual configuration of a configurable device is also referred to herein as the “as-built” configuration of the device.
In the present embodiment, LAN 110 includes or is coupled to a server 140. Server 140 executes utility controller software for managing the resources in LAN 110, and as such server 140 can also be referred to as a utility controller. For example, the utility controller software executed by server 140 enables the deployment, allocation, and management of VLANs. The utility controller software monitors deployed VLANs, and automatically reallocates resources when there is a reason to do so.
In the present embodiment, server 140 includes a utility controller database 150; alternatively, utility controller database 150 can reside in a separate storage device that is coupled to the server 140. Utility controller database 150 includes information pertaining to the various resources in LAN 110. Importantly, utility controller database 150 includes information that is regarded as a correct and accurate representation of the LAN 110 as it is designed and as it should be implemented.
The utility controller database 150 is also referred to herein as “reference information,” “design information,” or “design basis information.” As resources in LAN 110 are reallocated, the information in utility controller database 150 is also changed. Changes to the utility controller database 150 can also be used to drive changes to the allocation of resources in LAN 110. As will be seen, the present invention in its various embodiments verifies that the configuration or as-built information for each of the configurable devices in LAN 110 is correct relative to the reference or design information in utility controller database 150. In other words, embodiments of the present invention verify that the configurations of the configurable devices and the reference information in the utility controller database 150 are synchronized.
Utility controller database 150 includes information such as the types of devices in LAN 110 and a representation of each VLAN. Other information included in utility controller database 150 includes, but is not limited to: the network or MAC (media access control) address for the resources of LAN 110; the port numbers of the configurable devices; the VLAN identifiers associated with each of the port numbers; the socket identifier for each cable connected to each of the resources of LAN 110; manufacturer and model numbers; and serial numbers.
In one embodiment, utility controller database 150 is embodied as a computer-readable network map. It is understood that such a map need not exist in the form conventionally associated with human-readable maps. It is also appreciated that a computer-readable network map can be synthesized on-the-fly from the information stored in utility controller database 150.
In the example of
In the present embodiment, the VLAN verifier (e.g., the VLAN verification software) is coupled to the utility controller database 150. As described above, utility controller database 150 includes reference or design information for LAN 110. The VLAN verifier is also coupled to the fabric 160 of configurable devices (e.g., switches 111–116). In general, the VLAN verifier has access to the configuration information for each of the switches 111–116. This can be accomplished by communicating with one of the switches that in turn communicates with each of the other switches, by directly communicating with each switch either in series or in parallel, or by some combination of these actions.
Flowchart 400 of
In step 410, in the present embodiment, configuration information is received for each of the configurable devices in a virtual network. In one embodiment, the configuration information is received in response to a command issued to the configurable devices by, for example, the VLAN verifier (e.g., the VLAN verification software of
In another embodiment, the configuration information is provided to the VLAN verifier in response to some sort of triggering event. For example, if the configurable device experiences a change in its configuration information (e.g., the device is allocated to a different VLAN), then it can automatically provide its configuration information to the VLAN verifier. In yet another embodiment, the configuration information resident on each configurable device is accessed and read by the VLAN verifier. For example, instead of requesting the information and waiting for a response, the VLAN verifier accesses a known memory location on the configurable device and reads the configuration information that is stored there. Other methods for exchanging information between the configurable devices and the VLAN verification software can be used.
In step 420 of
In step 430 of
In step 440, the results of the comparison of step 430 are reported and any corrective actions are identified. The report and corrective actions can be of various forms, either human-readable or computer-readable or both. In one embodiment, if the configuration information and the reference information agree, then a report message is generated indicating that the as-built configuration of the VLAN is correct. A report message can optionally be generated for each instance of agreement between the configuration information and the reference information. In other words, a report message can be generated for each device in the VLAN, or even for the various elements of each device (e.g., for each port on each device).
In the present embodiment, a report message is also generated for each discrepancy between the configuration information and the reference information. This message can indicate that the as-built configuration of the VLAN is not correct, and can provide relevant information identifying the specifics of each discrepancy.
As mentioned, corrective actions can also be identified. In one embodiment, lines of text describing commands that can be used to bring the VLAN into compliance with the reference information are generated. Command lines specific to the various types of configurable devices present in the VLAN can be generated. In one embodiment, corrective actions can be implemented via electronically-transmitted commands by a program (e.g., by VLAN verification software 140 of
In one embodiment, a human-readable report and/or a computer-readable report file are generated, summarizing the messages described above. In another embodiment, a human-readable set of commands and/or a computer-readable command file are generated. These commands include the corrective actions for bring the configuration information (and hence the as-built configuration of the VLAN) into compliance with the reference information in the utility controller database 150 (
In step 450 of
The discussion above is based on the presumption that the reference information (e.g., utility controller database 150 of
In the embodiment of
In summary, embodiments of the present invention provide methods and systems that can verify that configurable devices (e.g., switches) and hence VLANs are properly configured. By virtue of automation, correctness of the VLANs can be verified in less time, at less expense, and as often as desired. Each instance of an incorrect or otherwise unsatisfactory VLAN can be pinpointed quickly and early. Corrective actions are generated and readily implemented. Because these corrective actions can be computer-generated and, in some instances, automatically implemented, the risk of human error is reduced.
In addition to verifying correctness of the VLANs, embodiments of the present invention also facilitate improving the performance of the VLANs. For example, if VLAN performance is less than expected, the configuration of the VLAN can be quickly eliminated as a source of the problem, allowing administrators to focus on other possible sources of trouble.
As mentioned, the VLAN verification software and method thereof can be executed periodically or on demand. Accordingly, configurable devices can be checked for correctness even when a change in configuration information is not anticipated. In other words, a change in the configuration information of a configurable device due to a hardware malfunction, intervention by an unauthorized third party, or the like, would be detectable, even if the configurable device is not being used as part of a VLAN. In addition, configurable devices can be confidently replaced or removed from service (e.g., for maintenance), because the VLAN verification software provides assurance that the new hardware is properly configured.
Embodiments of the present invention are thus described. While the present invention has been described in particular embodiments, it should be appreciated that the present invention should not be construed as limited by such embodiments, but rather construed according to the following claims.
|Cited Patent||Filing date||Publication date||Applicant||Title|
|US6085238 *||Apr 22, 1997||Jul 4, 2000||Matsushita Electric Works, Ltd.||Virtual LAN system|
|US6363411 *||Oct 19, 1999||Mar 26, 2002||Mci Worldcom, Inc.||Intelligent network|
|US6971028 *||Jul 14, 2000||Nov 29, 2005||Symantec Corporation||System and method for tracking the source of a computer attack|
|US20030105881 *||Dec 3, 2001||Jun 5, 2003||Symons Julie Anna||Method for detecting and preventing intrusion in a virtually-wired switching fabric|
|US20040024881 *||Jul 31, 2002||Feb 5, 2004||Elving Christopher H.||System and method for sticky routing of requests within a server farm|
|US20040034702 *||Aug 16, 2002||Feb 19, 2004||Nortel Networks Limited||Method and apparatus for exchanging intra-domain routing information between VPN sites|
|US20040083308 *||Oct 24, 2002||Apr 29, 2004||Sebastian Bino J.||Network configuration synchronization for hardware accelerated network protocol|
|US20040120260 *||Dec 18, 2002||Jun 24, 2004||Mark Bernier||Methods and apparatus for providing security to a computerized device|
|US20040123091 *||Dec 20, 2002||Jun 24, 2004||Nokia Inc.||Automated bulk configuration of network devices|
|US20040148375 *||Feb 12, 2002||Jul 29, 2004||Levett David Lawrence||Presentation service which enables client device to run a network based application|
|US20040177166 *||Mar 5, 2003||Sep 9, 2004||International Business Machines Corporation||Network access point apparatus and method|
|US20040203593 *||Aug 9, 2002||Oct 14, 2004||Robert Whelan||Mobile unit configuration management for WLANs|
|US20040213258 *||Apr 25, 2003||Oct 28, 2004||Sundaresan Ramamoorthy||Implementing information technology management policies|
|US20050027851 *||May 22, 2002||Feb 3, 2005||Mckeown Jean Christophe||Broadband communications|
|Citing Patent||Filing date||Publication date||Applicant||Title|
|US7804781||Nov 20, 2008||Sep 28, 2010||At&T Intellectual Property I, L.P.||Methods and apparatus to detect border gateway protocol session failures|
|US8024618 *||Mar 30, 2007||Sep 20, 2011||Apple Inc.||Multi-client and fabric diagnostics and repair|
|US8732703||Jan 23, 2009||May 20, 2014||Hewlett-Packard Development Company, L.P.||Verifying virtual machines|
|CN103312765A *||Mar 7, 2013||Sep 18, 2013||Abb研究有限公司||Reachability validation of nodes of a network of an industrial automation and control system|
|CN103312765B *||Mar 7, 2013||Jun 22, 2016||Abb研究有限公司||验证工业自动化和控制系统的网络的节点的可达性|
|WO2010085255A1 *||Jan 23, 2009||Jul 29, 2010||Hewlett-Packard Development Company, L.P.||Verifying virtual machines|
|WO2016199404A1 *||Jun 7, 2016||Dec 15, 2016||日本電気株式会社||Network verification device, network verification method and program recording medium|
|U.S. Classification||703/13, 703/21, 709/248, 713/2, 709/249|
|International Classification||H04L12/46, H04L12/24, G06G7/48, G06F15/173, G06F9/455|
|Cooperative Classification||H04L12/4675, H04L41/0873|
|European Classification||H04L12/46V3, H04L41/08C2|
|Sep 11, 2003||AS||Assignment|
Owner name: HEWLETT-PACKARD DEVELOPMENT COMPANY, LP., TEXAS
Free format text: ASSIGNMENT OF ASSIGNORS INTEREST;ASSIGNORS:GRAVES, DAVID ANDREW;O KEEFE, BRIAN JOHN;REEL/FRAME:014476/0766;SIGNING DATES FROM 20030515 TO 20030520
|Feb 2, 2010||CC||Certificate of correction|
|Aug 27, 2010||FPAY||Fee payment|
Year of fee payment: 4
|Oct 10, 2014||REMI||Maintenance fee reminder mailed|
|Feb 27, 2015||LAPS||Lapse for failure to pay maintenance fees|
|Apr 21, 2015||FP||Expired due to failure to pay maintenance fee|
Effective date: 20150227